BottleCRM 1.1.3 SSTI Vulnerability (CVE-2026-110593) Allows Remote Code Execution

CVE-2026-110593 Vulnerability Summary Vulnerability Overview BottleCRM version 1.1.3 contains a Server-Side Template Injection (SSTI) vulnerability. This vulnerability allows an attacker to execute arbitrary PHP code by submitting a crafted POST request to the endpoint. Scope of Impact Affected Product: BottleCRM Affected Version: 1.1.3 Vulnerability Type: Server-Side Template Injection (SSTI) CVSS Score: 9.8 (Critical) Source: https://www.bottlecrm.com/ Remediation 1. Upgrade Version: Upgrade BottleCRM to the latest version, which includes a fix for this vulnerability. 2. Input Validation: Perform strict validation and sanitization of all user inputs on the server side, especially those used for template rendering. 3. Avoid Dynamic Templates: Avoid using user-supplied data as template names or content. 4. Secure Configuration: Ensure PHP configuration is secure by disabling unnecessary functions such as , , etc. POC Code 1. Create Target Contact 2. Send Malicious SSTI Email 3. Trigger Code Execution 4. Exploitation Code Example 5. Remediated Code Example Evidence Description Indicator: Value: Description: This indicator is used to verify the template injection vulnerability. If the template engine correctly renders this expression, it indicates the presence of the vulnerability. Vulnerable Code Section Recommended Remediation 1. Upgrade Version: Upgrade BottleCRM to the latest version. 2. Input Validation: Perform strict validation and sanitization of all user inputs on the server side. 3. Avoid Dynamic Templates: Avoid using user-supplied data as template names or content. 4. Secure Configuration: Ensure PHP configuration is secure by disabling unnecessary functions. Proof of Concept 1. Create Target Contact: Use the provided PHP code to create a target contact. 2. Send Malicious SSTI Email: Use the provided PHP code to send an email containing a malicious SSTI payload. 3. Trigger Code Execution: Use the provided PHP code to trigger code execution. 4. Exploitation Code Example: Use the provided PHP code example for exploitation. 5. Remediated Code Example: Use the provided PHP code example for remediation. Evidence Description Indicator: Value: Description: This indicator is used to verify the template injection vulnerability. If the template engine correctly renders this expression, it indicates the presence of the vulnerability. Vulnerable Code Section Recommended Remediation 1. Upgrade Version: Upgrade BottleCRM to the latest version. 2. Input Validation: Perform strict validation and sanitization of all user inputs on the server side. 3. Avoid Dynamic Templates: Avoid using user-supplied data as template names or content. 4. Secure Configuration: Ensure PHP configuration is secure by disabling unnecessary functions. Proof of Concept 1. Create Target Contact: Use the provided PHP code to create a target contact. 2. Send Malicious SSTI Email: Use the provided PHP code to send an email containing a malicious SSTI payload. 3. Trigger Code Execution: Use the provided PHP code to trigger code execution. 4. Exploitation Code Example: Use the provided PHP code example for exploitation. 5. Remediated Code Example: Use the provided PHP code example for remediation. Evidence Description Indicator: Value: Description: This indicator is used to verify the template injection vulnerability. If the template engine correctly renders this expression, it indicates the presence of the vulnerability. Vulnerable Code Section Recommended Remediation 1. Upgrade Version: Upgrade BottleCRM to the latest version. 2. Input Validation: Perform strict validation and sanitization of all user inputs on the server side. 3. Avoid Dynamic Templates: Avoid using user-supplied data as template names or content. 4. Secure Configuration: Ensure PHP configuration is secure by disabling unnecessary functions. Proof of Concept 1. Create Target Contact: Use the provided PHP code to create a target contact. 2. Send Malicious SSTI Email: Use the provided PHP code to send an email containing a malicious SSTI payload. 3. Trigger Code Execution: Use the provided PHP code to trigger code execution. 4. Exploitation Code Example: Use the provided PHP code example for exploitation. 5. Remediated Code Example: Use the provided PHP code example for remediation. Evidence Description Indicator: Value: Description: This indicator is used to verify the template injection vulnerability. If the template engine correctly renders this expression, it indicates the presence of the vulnerability. Vulnerable Code Section Recommended Remediation 1. Upgrade Version: Upgrade BottleCRM to the latest version. 2. Input Validation: Perform strict validation and sanitization of all user inputs on the server side. 3. Avoid Dynamic Templates: Avoid using user-supplied data as template names or content. 4. Secure Configuration: Ensure PHP configuration is secure by disabling unnecessary functions. Proof of Concept 1. Create Target Contact: Use the provided PHP code to create a

Goal Reached Thanks to every supporter — we hit 100%!

BottleCRM 1.1.3 SSTI Vulnerability (CVE-2026-110593) Allows Remote Code Execution

More from this source